Re: msync() bug

[Andrew Morton <andrewm@uow.edu.au>]

Andrea Arcangeli wrote:
> 
> Wrong fix, `page' is just garbage if some non memory was mapped in
> userspace (like framebuffers or similar mmio regions were mapped etc..).

Now we're getting somewhere.  Thanks.  Tell me if this is right:
 

> if (VALID_PAGE(page)

If the physical address of the page is somewhere inside our
working RAM.

> !PageReserved(page)

And it's not a reserved page (discontigmem?)

> ptep_test_and_clear_dirty(ptep))

And if it was modified via this mapping

> +                       flush_tlb_page(vma, address);
> +                       set_page_dirty(page);

Question:  What happens if a program mmap's a part of /dev/mem
which passes all of these tests?   Couldn't it then pick some
arbitrary member of mem_map[] which may or may not have
a non-zero ->mapping?